[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [EXT] Re: [cti] [EXT] [cti] Location as a Top-Level SDO
The only use-case I have heard for a location SDO is the ability to allow a third party to say they think this threat actor for example is also in this other location. To allow for this use case, you would need either have the location be an SDO or you would need to use a note or opinion object.
I would ask that if location is an SDO, then other properties probably should also be made SDOs.
Bret From: Wunder, John A. <jwunder@mitre.org>
Sent: Monday, June 12, 2017 2:12:29 PM To: Patrick Maroney; Bret Jordan Cc: Jason Mr. Keirstead; John-Mark Mr. Gurney; cti@lists.oasis-open.org; Back, Greg; Nathan.Reller@jhuapl.edu Subject: [EXT] Re: [cti] [EXT] [cti] Location as a Top-Level SDO Yeah +1 to Pat…we’re a CTI org, let’s not maintain a database of geolocations.
More generally I also agree w/ Allan that this doesn’t really impact the SDO question. Either you:
It would be nice to enumerate these types of scenarios and see how we can deal with each of them in each approach. I talked to Allan and I think he has the beginnings of that
document started, I’ll get with him to push it to Google docs so we can all look over it. John From:
<cti@lists.oasis-open.org> on behalf of Patrick Maroney <pmaroney@wapacklabs.com> My .02: If we're building, publishing, maintaining our own Geo-Location Data, we're doing something wrong. This is one wheel we do not need to re-invent...again just my .02. Patrick Maroney Principal Engineer - Data Science & Analytics Wapack Labs LLC (609)841-5104 On Jun 11, 2017, at 11:58 PM, Bret Jordan <Bret_Jordan@symantec.com> wrote: So if we were going to do this, we would probably need to build a library of locations by country and regions and publish them as a Committee Note and hope people just use the them for locations
at the granularity of a country or group of countries. Bret From: cti@lists.oasis-open.org
<cti@lists.oasis-open.org> on behalf of Jason Keirstead <Jason.Keirstead@ca.ibm.com> You are assuming that we don't create a repository of "standard" location SDOs for things like continent and country names - IE the things that people would want to share in
the first place. Which, I don't see why we would not do this, seeing how we're doing it for things like CAPEC. -
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]